ClawHub
Back to skill

Security audit

Proactive Daily Planner

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal daily planner skill that saves local plan files and only suggests optional scheduling, with no evidence of hidden network, destructive, or deceptive behavior.

Before installing, understand that this skill can save daily planning notes under your OpenClaw memory directory. Only add the suggested cron or HEARTBEAT automation if you want recurring runs, and periodically delete or protect saved plan files if they contain sensitive personal or work details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly encourages scheduled automatic execution and documents persistent storage of daily plans, task history, and progress statistics, but it does not clearly warn users that the skill will continuously write behavioral data to disk over time. In a personal assistant context, this can expose sensitive routines, productivity patterns, and personal notes to other local users, backups, or downstream tools, especially when automation is enabled via cron or heartbeat integration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation indicates shell and environment-related capabilities through installation/usage commands and filesystem data storage, but it declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where an agent or platform may grant broader execution capability than users expect, increasing the risk of unintended command execution or access to local data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes proactive and automatic behavior but does not define precise trigger conditions, rate limits, or boundaries on what actions it may take when activated. Ambiguous auto-triggering can cause the agent to run unexpectedly, access user context too broadly, or initiate repeated actions without meaningful user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The statement that the skill runs automatically based on a schedule lacks constraints around scope, duration, and permitted actions during scheduled execution. In a proactive assistant context, this is risky because recurring autonomous runs could repeatedly access memory files, send notifications, or invoke other integrated skills without sufficiently bounded authorization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description is broad enough that the agent may activate in situations beyond simple daily planning, increasing the chance of unsolicited proactive behavior or access to user context not strictly needed for the task. In a proactive assistant, vague scope is more dangerous because the design already encourages autonomous check-ins and planning actions throughout the day.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a proactive daily planning assistant, which suggests generating guidance and organizing tasks, but this implementation also persists content directly to the user's filesystem. Local file writing is a materially broader operation than purely assisting via planning dialogue, and it is not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 86)May include surrounding context.

sh
echo "  Add to your HEARTBEAT.md or create a cron job"
echo ""
echo "💡 Pro tip: Set up a daily reminder:"
echo "  crontab -e"
echo "  # Add: 0 8 * * * cd $INSTALL_DIR && node planner.js morning"
echo "  # Add: 0 13 * * * cd $INSTALL_DIR && node planner.js progress"
echo "  # Add: 0 20 * * * cd $INSTALL_DIR && node planner.js evening"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Natural-language policy checks apply to all file types. Setting the user's timezone to a fixed locale-related value can impose a locale preference without opt-in, and the file does not indicate that the user can choose or override this setting.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The package description advertises a broadly proactive personal-assistant capability without defining concrete trigger phrases, invocation scope, or user-consent boundaries. In an agent ecosystem, this can cause overbroad activation or invocation in contexts beyond simple planning, increasing the chance of unintended access to user context or actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

A proactive daily planner does not need shell-command execution to organize a day, track tasks, or provide motivation. Even though execSync is not used elsewhere in this file, including child process capability is unjustified by the declared purpose and expands the available attack surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code hard-codes en-US for weekday and time formatting, which imposes a specific locale on all users regardless of preference. This is a natural-language/locale policy concern because the skill does not offer any locale choice or explain why a U.S. English format is required.

Content

No source excerpt is available for this finding.